Troj/Wrmscan-A is a Trojan for the Windows platform.
Troj/Wrmscan-A displays a fake message that reads:
"4 viruses successful deleted"
Troj/Wrmscan-A modifies any files named "mirc.ini" by adding the following lines:
"[rfiles]
n0=server.mrc"
The Trojan then creates a file named "server.mrc" in the same folder as the "mirc.ini" file that causes the IRC program to periodically send a message directing the recipient to a particular website.
Troj/Wrmscan-A copies itself to the Windows folder as "svchost.exe" and sets the following registry entry in order to run automatically on computer login:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
SVCHOST.EXE =
%Windows%\SVCHOST.EXE